Crypto hackers stole $3.3 billion in 2025, but the number of attacks fell sharply as losses became concentrated in fewer, more sophisticated supply-chain exploits, according to new data from blockchain security firm CertiK shared with Cointelegraph.<\/p>\n
While total losses remained elevated, the decline in incident counts and a drop in median theft sizes suggest that protocol-level security is improving, pushing attackers away from simple code vulnerabilities and toward phishing and infrastructure-level attacks.<\/p>\n
CertiK said supply-chain breaches emerged as the most damaging threat, accounting for $1.45 billion in losses across just two incidents, including the $1.4 billion Bybit hack in February.<\/a><\/p>\n “The Bybit exploit signals that well-capitalized, well-coordinated threat actors are becoming more active across the ecosystem,” the report said, predicting a rise in the \u201csophistication\u201d of supply chain attacks as attackers target more infrastructure providers.<\/p>\n Related: <\/strong><\/em>Soulja Boy token sparks backlash after Base co-founder posts purchase receipt<\/strong><\/em><\/a><\/p>\n The number of security incidents decreased by 162 counts year-over-year, indicating that blockchain cybersecurity measures are improving despite hackers aiming for larger targets.<\/p>\n The average amount lost per hack stood at $5.3 million, a 66% increase from the previous year. However, the median loss \u2014 a measure less influenced by outlier incidents \u2014 fell to $103,966, down 35.75% over the same period.<\/p>\n Related: <\/strong><\/em>Solana AI token Ava hit by launch sniping tied to deployer: Bubblemaps<\/strong><\/em><\/a><\/p>\n Phishing scams became the second-largest threat, costing crypto investors a cumulative $722 million across 248 incidents.<\/p>\n Recently, an investor lost their entire Bitcoin (BTC<\/a>) retirement fund in an artificial intelligence-fueled romance scam<\/a>, also known as a “pig butchering” scam, where the con artists used prolonged emotional manipulation to convince the investors to transfer their funds.<\/p>\n Pig butchering scams are a subset of phishing scams that cost the industry a collective $5.5 billion in 2024<\/a>, across 200,000 individual cases.<\/p>\n Notably, the average grooming period for victims is between one and two weeks in 35% of cases, while 10% of scams involve grooming periods of up to three months, according to blockchain security platform Cyvers.<\/p>\n In June, the US Department of Justice announced the seizure of over $225 million in<\/a> crypto linked to pig butchering scams.<\/p>\n![](\"https:\/\/s3.cointelegraph.com\/uploads\/2025-12\/019b4a94-be59-7c2c-8a6f-79f49b5373cf.png\" "\\"\\"\/")
Code vulnerabilities fade as \u201cpig butchering\u201d scams threaten crypto savings<\/h2>\n
![](\"https:\/\/s3.cointelegraph.com\/uploads\/2025-12\/019b4aac-8468-78b8-9eef-5dd8caed8d6f.png\" "\\"\\"\/")